CVE-2023-28319

Katalog CVE

CVSS 7.5 · High EPSS 2,5%

Kerentanan Use After Free pada haxx curl, apple macos +6 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.

Rincian

Terbit di NVD

26 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://hackerone.com/reports/1913733 exploit · patch · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2023/Jul/47 mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2023/Jul/48 mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2023/Jul/52 mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202310-12 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230609-0009/ advisory pihak ketiga
• https://support.apple.com/kb/HT213843 advisory pihak ketiga
• https://support.apple.com/kb/HT213844 advisory pihak ketiga
• https://support.apple.com/kb/HT213845 advisory pihak ketiga